@voxgig/sdkgen 4.9.0 → 4.11.0

package/project/.sdk/tm/php/feature/secrets/sekreto/plugins/doppler.php

@@ -0,0 +1,106 @@
+<?php
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (php/plugins/doppler.php)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+
+/**
+ * Doppler, as a voxgig/plugin definition.
+ *
+ * A PLUGIN, not a built-in: it opens a socket.
+ */
+
+declare(strict_types=1);
+
+namespace Voxgig\Sekreto\Plugins;
+
+require_once __DIR__ . '/../src/Providers.php';
+require_once __DIR__ . '/../src/Addr.php';
+require_once __DIR__ . '/httpjson.php';
+
+use Voxgig\Sekreto\Name;
+use Voxgig\Sekreto\Provider;
+use Voxgig\Sekreto\SekretoError;
+
+use function Voxgig\Sekreto\checkaddr;
+use function Voxgig\Sekreto\providerplugin;
+
+/**
+ * Doppler.
+ *
+ * The whole config is downloaded once - Doppler's own bulk endpoint - and
+ * answered from memory, like a remote .env: `api.token` is the
+ * `API_TOKEN` entry. A service token is config-scoped, so project and
+ * config are only needed with broader tokens.
+ */
+class DopplerProvider implements Provider
+{
+    /** @var array<string, string>|null */
+    private ?array $values = null;
+
+    /** @param array<string, mixed> $opts */
+    public function __construct(private array $opts = [])
+    {
+    }
+
+    /** @return array<string, string> */
+    private function load(): array
+    {
+        if (null !== $this->values) {
+            return $this->values;
+        }
+
+        $addr = rtrim(($this->opts['addr'] ?? null) ?: 'https://api.doppler.com', '/');
+        checkaddr($addr);
+
+        $url = $addr . '/v3/configs/config/secrets/download?format=json';
+        if ($this->opts['project'] ?? null) {
+            $url .= '&project=' . rawurlencode($this->opts['project']);
+        }
+        if ($this->opts['config'] ?? null) {
+            $url .= '&config=' . rawurlencode($this->opts['config']);
+        }
+
+        [$status, $body] = fetchjson(
+            'GET',
+            $url,
+            ['Authorization: Bearer ' . ($this->opts['token'] ?? '')]
+        );
+
+        if (200 !== $status || !is_array($body)) {
+            throw new SekretoError('sekreto: doppler error: ' . $status);
+        }
+
+        $this->values = [];
+        foreach ($body as $key => $value) {
+            if (null !== $value) {
+                $this->values[$key] = (string) $value;
+            }
+        }
+
+        return $this->values;
+    }
+
+    public function lookup(string $name): ?string
+    {
+        return $this->load()[Name::envkey($name)] ?? null;
+    }
+
+    public function describe(): string
+    {
+        $project = $this->opts['project'] ?? null;
+
+        return 'doppler'
+            . ($project ? ':' . $project . '/' . ($this->opts['config'] ?? '') : '');
+    }
+}
+
+/**
+ * The `doppler` provider kind, as a voxgig/plugin definition. Pass it to
+ * `Sekreto` in the `plugins` option; nothing else loads it.
+ *
+ * @return array<string, mixed>
+ */
+function doppler(): array
+{
+    return providerplugin('doppler', fn(array $spec) => new DopplerProvider($spec));
+}

package/project/.sdk/tm/php/feature/secrets/sekreto/plugins/gcpsecrets.php

@@ -0,0 +1,144 @@
+<?php
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (php/plugins/gcpsecrets.php)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+
+/**
+ * GCP Secret Manager, as a voxgig/plugin definition.
+ *
+ * A PLUGIN, not a built-in: it opens a socket.
+ */
+
+declare(strict_types=1);
+
+namespace Voxgig\Sekreto\Plugins;
+
+require_once __DIR__ . '/../src/Providers.php';
+require_once __DIR__ . '/../src/Addr.php';
+require_once __DIR__ . '/httpjson.php';
+
+use Voxgig\Sekreto\Name;
+use Voxgig\Sekreto\Provider;
+use Voxgig\Sekreto\SekretoError;
+
+use function Voxgig\Sekreto\checkaddr;
+use function Voxgig\Sekreto\providerplugin;
+
+/**
+ * GCP Secret Manager.
+ *
+ * `api.token` reads secret `api_token` (dots flattened to `_`; Secret
+ * Manager ids have no hierarchy and reject dots), latest version. The
+ * token comes from config, then `GOOGLE_OAUTH_ACCESS_TOKEN`, then the
+ * GCE/GKE metadata server - so on Google's own platform no credential
+ * configuration is needed at all.
+ *
+ * The metadata call itself is plain http to a link-local host by platform
+ * design; no credential rides on it, so `checkaddr` guards the Secret
+ * Manager address instead.
+ */
+class GcpSecretsProvider implements Provider
+{
+    // A configured token is kept forever; a metadata-server token carries
+    // expires_in and is renewed shortly before it runs out.
+    private ?string $livetoken = null;
+    private float $renewat = INF;
+
+    /** @param array<string, mixed> $opts */
+    public function __construct(private array $opts = [])
+    {
+    }
+
+    private function metadataaddr(): string
+    {
+        $addr = $this->opts['metadataaddr'] ?? null;
+        if ($addr) {
+            return $addr;
+        }
+
+        $host = getenv('GCE_METADATA_HOST');
+
+        return $host ? 'http://' . $host : 'http://metadata.google.internal';
+    }
+
+    private function login(): string
+    {
+        $configured = ($this->opts['token'] ?? null) ?: getenv('GOOGLE_OAUTH_ACCESS_TOKEN');
+        if ($configured) {
+            return $configured;
+        }
+
+        $url = rtrim($this->metadataaddr(), '/')
+            . '/computeMetadata/v1/instance/service-accounts/default/token';
+
+        [$status, $body] = fetchjson('GET', $url, ['Metadata-Flavor: Google']);
+
+        $got = $body['access_token'] ?? null;
+        if (200 !== $status || !$got) {
+            throw new SekretoError('sekreto: gcp: no token and metadata server did not answer');
+        }
+
+        $expires = (float) ($body['expires_in'] ?? 0);
+        $this->renewat = 0 < $expires ? microtime(true) + max($expires - 60, 1) : INF;
+
+        return (string) $got;
+    }
+
+    public function lookup(string $name): ?string
+    {
+        $project = $this->opts['project'] ?? '';
+        if ('' === $project || null === $project) {
+            throw new SekretoError('sekreto: gcp: no project');
+        }
+
+        $addr = ($this->opts['addr'] ?? null) ?: 'https://secretmanager.googleapis.com';
+        checkaddr($addr);
+
+        if (null === $this->livetoken || microtime(true) >= $this->renewat) {
+            $this->livetoken = $this->login();
+        }
+
+        $url = rtrim($addr, '/') . '/v1/projects/' . $project . '/secrets/'
+            . Name::flatname($name, '_') . '/versions/latest:access';
+
+        [$status, $body] = fetchjson('GET', $url, ['Authorization: Bearer ' . $this->livetoken]);
+
+        if (404 === $status) {
+            return null;
+        }
+
+        if (200 !== $status) {
+            throw new SekretoError('sekreto: gcp error: ' . $status . ': ' . $url);
+        }
+
+        $data = $body['payload']['data'] ?? null;
+        if (!is_string($data)) {
+            return null;
+        }
+
+        // See the aws provider: strict, and an undecodable payload is an
+        // error rather than a miss.
+        $decoded = base64_decode($data, true);
+        if (false === $decoded) {
+            throw new SekretoError('sekreto: gcp: undecodable secret');
+        }
+
+        return $decoded;
+    }
+
+    public function describe(): string
+    {
+        return 'gcpsecrets:' . ($this->opts['project'] ?? '');
+    }
+}
+
+/**
+ * The `gcpsecrets` provider kind, as a voxgig/plugin definition. Pass it to
+ * `Sekreto` in the `plugins` option; nothing else loads it.
+ *
+ * @return array<string, mixed>
+ */
+function gcpsecrets(): array
+{
+    return providerplugin('gcpsecrets', fn(array $spec) => new GcpSecretsProvider($spec));
+}

package/project/.sdk/tm/php/feature/secrets/sekreto/plugins/hashicorp.php

@@ -0,0 +1,194 @@
+<?php
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (php/plugins/hashicorp.php)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+
+/**
+ * HashiCorp Vault, as a voxgig/plugin definition.
+ *
+ * A PLUGIN, not a built-in: it opens a socket. The four built-in kinds read
+ * at most a local file, and a chain of them never requires this file.
+ */
+
+declare(strict_types=1);
+
+namespace Voxgig\Sekreto\Plugins;
+
+require_once __DIR__ . '/../src/Providers.php';
+require_once __DIR__ . '/../src/Addr.php';
+require_once __DIR__ . '/httpjson.php';
+
+use Voxgig\Sekreto\Name;
+use Voxgig\Sekreto\Provider;
+use Voxgig\Sekreto\SekretoError;
+
+use function Voxgig\Sekreto\checkaddr;
+use function Voxgig\Sekreto\providerplugin;
+use function Voxgig\Sekreto\writejson;
+
+/**
+ * HashiCorp Vault.
+ *
+ * KV v2 (the default): `api.token` reads `{addr}/v1/{mount}/data/api` and
+ * takes the `token` field of `data.data`. KV v1 (`kv: 1`) reads
+ * `{addr}/v1/{mount}/api` and takes the field of `data`. A 404 means "not
+ * here" - a miss - so a vault can sit in a chain with fallbacks.
+ *
+ * A Vault Enterprise namespace rides the X-Vault-Namespace header, on
+ * logins as well as reads.
+ *
+ * Instead of being handed a token, the provider can log in: Kubernetes
+ * auth (the pod's service-account JWT, from its conventional path) or
+ * AppRole. A failed login is an error, never a miss - it means this store
+ * could not answer at all.
+ */
+class HashicorpProvider implements Provider
+{
+    private string $mount;
+    private int $kv;
+
+    /**
+     * The working token: a configured token is kept forever, a logged-in
+     * token is renewed shortly before its lease runs out - a long-running
+     * process must not keep presenting a token the vault already expired.
+     */
+    private ?string $livetoken;
+    private float $renewat = INF;
+
+    /** @param array<string, mixed>|null $auth */
+    public function __construct(
+        private string $addr,
+        string $token,
+        ?string $mount = null,
+        ?int $kv = null,
+        private ?string $vaultnamespace = null,
+        private ?array $auth = null
+    ) {
+        $this->mount = $mount ?? 'secret';
+        $this->kv = $kv ?: 2;
+
+        // A version typo like kv: 3 must not quietly behave as v2 and turn
+        // its 404s into misses; there is nothing safe to assume it meant.
+        if (1 !== $this->kv && 2 !== $this->kv) {
+            throw new SekretoError(
+                'sekreto: hashicorp: unsupported kv version: ' . $this->kv
+            );
+        }
+
+        $this->livetoken = '' === $token ? null : $token;
+    }
+
+    /** @return array<int, string> */
+    private function baseheaders(): array
+    {
+        $headers = [];
+
+        if ($this->vaultnamespace) {
+            $headers[] = 'X-Vault-Namespace: ' . $this->vaultnamespace;
+        }
+
+        return $headers;
+    }
+
+    private function login(): string
+    {
+        $auth = $this->auth;
+
+        if (null === $auth) {
+            throw new SekretoError('sekreto: hashicorp: no token and no auth method');
+        }
+
+        $method = $auth['method'] ?? null;
+        $mount = $auth['mount'] ?? $method;
+        $url = rtrim($this->addr, '/') . '/v1/auth/' . $mount . '/login';
+
+        if ('kubernetes' === $method) {
+            $jwt = $auth['jwt'] ?? null;
+            if (null === $jwt) {
+                $file = ($auth['jwtfile'] ?? null)
+                    ?: '/var/run/secrets/kubernetes.io/serviceaccount/token';
+                $text = @file_get_contents($file);
+                if (false === $text) {
+                    throw new SekretoError('sekreto: hashicorp: cannot read jwt file ' . $file);
+                }
+                $jwt = trim($text);
+            }
+            $body = ['role' => $auth['role'] ?? '', 'jwt' => $jwt];
+        } elseif ('approle' === $method) {
+            $body = [
+                'role_id' => $auth['roleid'] ?? '',
+                'secret_id' => $auth['secretid'] ?? '',
+            ];
+        } else {
+            throw new SekretoError(
+                'sekreto: hashicorp: unknown auth method: ' . (string) $method
+            );
+        }
+
+        [$status, $answer] = fetchjson('POST', $url, $this->baseheaders(), writejson($body));
+
+        $got = $answer['auth']['client_token'] ?? null;
+        if (200 !== $status || !$got) {
+            throw new SekretoError('sekreto: hashicorp login failed: ' . $status . ': ' . $url);
+        }
+
+        $lease = (float) ($answer['auth']['lease_duration'] ?? 0);
+        $this->renewat = 0 < $lease ? microtime(true) + max($lease - 60, 1) : INF;
+
+        return (string) $got;
+    }
+
+    public function lookup(string $name): ?string
+    {
+        checkaddr($this->addr);
+
+        if (null === $this->livetoken || microtime(true) >= $this->renewat) {
+            $this->livetoken = $this->login();
+        }
+
+        $ref = Name::vaultref($name);
+        $base = rtrim($this->addr, '/') . '/v1/' . $this->mount;
+        $url = 1 === $this->kv ? $base . '/' . $ref['path'] : $base . '/data/' . $ref['path'];
+
+        $headers = $this->baseheaders();
+        $headers[] = 'X-Vault-Token: ' . $this->livetoken;
+
+        [$status, $body] = fetchjson('GET', $url, $headers);
+
+        if (404 === $status) {
+            return null;
+        }
+
+        if (200 !== $status) {
+            throw new SekretoError('sekreto: hashicorp error: ' . $status . ': ' . $url);
+        }
+
+        $data = 1 === $this->kv ? ($body['data'] ?? null) : ($body['data']['data'] ?? null);
+        $value = is_array($data) ? ($data[$ref['field']] ?? null) : null;
+
+        return null === $value ? null : (string) $value;
+    }
+
+    public function describe(): string
+    {
+        return 'hashicorp:' . $this->addr . '/' . $this->mount;
+    }
+}
+
+/**
+ * The `hashicorp` provider kind, as a voxgig/plugin definition. Pass it to
+ * `Sekreto` in the `plugins` option; nothing else loads it.
+ *
+ * @return array<string, mixed>
+ */
+function hashicorp(): array
+{
+    return providerplugin('hashicorp', fn(array $spec) => new HashicorpProvider(
+        $spec['addr'] ?? '',
+        $spec['token'] ?? '',
+        $spec['mount'] ?? null,
+        isset($spec['kv']) ? (int) $spec['kv'] : null,
+        $spec['vaultnamespace'] ?? null,
+        $spec['auth'] ?? null
+    ));
+}

package/project/.sdk/tm/php/feature/secrets/sekreto/plugins/httpjson.php

@@ -0,0 +1,113 @@
+<?php
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (php/plugins/httpjson.php)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+
+/**
+ * The HTTP half of every plugin that speaks to a store over the wire, in
+ * one place and OUTSIDE the core: a chain of built-ins never requires this
+ * file.
+ *
+ * One JSON round-trip, bounded in time and in size, refusing redirects and
+ * ignoring proxies. A port of typescript/plugins/httpjson.ts.
+ */
+
+declare(strict_types=1);
+
+namespace Voxgig\Sekreto\Plugins;
+
+require_once __DIR__ . '/../src/Sekreto.php';
+
+use Voxgig\Sekreto\SekretoError;
+
+/**
+ * One JSON round-trip, returning [status, decoded-json-or-null].
+ *
+ * A 404 is a normal answer here, not a failure: it means the store does not
+ * hold this secret. Network failure is always an error - an unreachable
+ * store is a store that could not answer. Uses the stream wrapper so that
+ * no extension beyond the default build is required.
+ *
+ * @param array<int, string> $headers
+ * @return array{0: int, 1: mixed}
+ */
+function fetchjson(string $method, string $url, array $headers, ?string $body = null): array
+{
+    $options = [
+        'method' => $method,
+        'header' => implode("\r\n", $headers),
+        // Read the body of an error response rather than throwing it away.
+        'ignore_errors' => true,
+        'timeout' => 10,
+        'follow_location' => 0,
+        'max_redirects' => 0,
+    ];
+
+    if (null !== $body) {
+        $options['content'] = $body;
+    }
+
+    $context = stream_context_create(['http' => $options]);
+
+    // maxlen + 1: an endless body would otherwise be accumulated in memory
+    // until the deadline, which on a loopback or datacentre link is
+    // gigabytes. One byte over the bound is enough to know it was exceeded.
+    $text = @file_get_contents($url, false, $context, 0, HTTP_MAXBODY + 1);
+
+    if (false === $text) {
+        throw new SekretoError('sekreto: cannot reach ' . explode('?', $url)[0]);
+    }
+
+    // An endless body is a store that could not answer, so this raises
+    // rather than returning a miss - the latter would fall through to a
+    // weaker store on an attacker's cue.
+    if (HTTP_MAXBODY < strlen($text)) {
+        throw new SekretoError('sekreto: oversized response from ' . explode('?', $url)[0]);
+    }
+
+    $status = 0;
+    foreach ($http_response_header ?? [] as $line) {
+        if (1 === preg_match('#^HTTP/\S+\s+(\d+)#', $line, $match)) {
+            $status = (int) $match[1];
+        }
+    }
+
+    $parsed = json_decode($text, true);
+
+    if (null === $parsed && JSON_ERROR_NONE !== json_last_error()) {
+        // A success status promised JSON; a body that does not parse means
+        // the store could not answer coherently, and treating it as a miss
+        // would fall through to a weaker store. Error statuses may carry
+        // any body - they are decided on status alone.
+        if (200 === $status) {
+            throw new SekretoError('sekreto: malformed response from ' . explode('?', $url)[0]);
+        }
+        $parsed = null;
+    }
+
+    return [$status, $parsed];
+}
+
+/**
+ * GET a URL, returning [status, decoded-json-or-null].
+ *
+ * @param array<int, string> $headers
+ * @return array{0: int, 1: mixed}
+ */
+function httpget(string $url, array $headers): array
+{
+    return fetchjson('GET', $url, $headers);
+}
+
+/**
+ * How much of a response body will be read before the store is treated as
+ * having answered incoherently. Ports carry the same bound.
+ *
+ * Far above anything real - the largest legitimate payload this library
+ * fetches is Doppler's whole-config download, measured in kilobytes. A bound
+ * is needed because the TIMEOUT is not one: ten seconds on a loopback or
+ * datacentre link is gigabytes, and the body is accumulated in memory before
+ * it is parsed. This runs on an application's startup path, so the failure is
+ * the application never starting.
+ */
+const HTTP_MAXBODY = 8 * 1024 * 1024;

package/project/.sdk/tm/php/feature/secrets/sekreto/plugins/infisical.php

@@ -0,0 +1,131 @@
+<?php
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (php/plugins/infisical.php)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+
+/**
+ * Infisical, as a voxgig/plugin definition.
+ *
+ * A PLUGIN, not a built-in: it opens a socket.
+ */
+
+declare(strict_types=1);
+
+namespace Voxgig\Sekreto\Plugins;
+
+require_once __DIR__ . '/../src/Providers.php';
+require_once __DIR__ . '/../src/Addr.php';
+require_once __DIR__ . '/httpjson.php';
+
+use Voxgig\Sekreto\Name;
+use Voxgig\Sekreto\Provider;
+use Voxgig\Sekreto\SekretoError;
+
+use function Voxgig\Sekreto\checkaddr;
+use function Voxgig\Sekreto\providerplugin;
+use function Voxgig\Sekreto\writejson;
+
+/**
+ * Infisical.
+ *
+ * `api.token` reads the secret keyed `API_TOKEN` (Infisical's own
+ * convention is environment-style keys) at a secret path in one
+ * environment of a project. Auth is a token, or a universal-auth (machine
+ * identity) login with clientid/clientsecret.
+ */
+class InfisicalProvider implements Provider
+{
+    // A configured token is kept forever; a universal-auth token carries
+    // expiresIn and is renewed shortly before it runs out.
+    private ?string $livetoken = null;
+    private float $renewat = INF;
+
+    /** @param array<string, mixed> $opts */
+    public function __construct(private array $opts = [])
+    {
+    }
+
+    private function login(string $addr): string
+    {
+        if ($this->opts['token'] ?? null) {
+            return $this->opts['token'];
+        }
+
+        $clientid = $this->opts['clientid'] ?? null;
+        $clientsecret = $this->opts['clientsecret'] ?? null;
+        if (!$clientid || !$clientsecret) {
+            throw new SekretoError('sekreto: infisical: no token and no client credentials');
+        }
+
+        [$status, $body] = fetchjson(
+            'POST',
+            $addr . '/api/v1/auth/universal-auth/login',
+            ['Content-Type: application/json'],
+            writejson(['clientId' => $clientid, 'clientSecret' => $clientsecret])
+        );
+
+        $got = $body['accessToken'] ?? null;
+        if (200 !== $status || !$got) {
+            throw new SekretoError('sekreto: infisical login failed: ' . $status);
+        }
+
+        $expires = (float) ($body['expiresIn'] ?? 0);
+        $this->renewat = 0 < $expires ? microtime(true) + max($expires - 60, 1) : INF;
+
+        return (string) $got;
+    }
+
+    public function lookup(string $name): ?string
+    {
+        $addr = rtrim(($this->opts['addr'] ?? null) ?: 'https://app.infisical.com', '/');
+        checkaddr($addr);
+
+        $project = $this->opts['project'] ?? '';
+        $environment = $this->opts['environment'] ?? '';
+        if ('' === $project || null === $project
+            || '' === $environment || null === $environment
+        ) {
+            throw new SekretoError('sekreto: infisical: no project/environment');
+        }
+
+        if (null === $this->livetoken || microtime(true) >= $this->renewat) {
+            $this->livetoken = $this->login($addr);
+        }
+
+        $url = $addr . '/api/v3/secrets/raw/' . Name::envkey($name)
+            . '?workspaceId=' . rawurlencode($project)
+            . '&environment=' . rawurlencode($environment)
+            . '&secretPath=' . rawurlencode(($this->opts['path'] ?? null) ?: '/');
+
+        [$status, $body] = fetchjson('GET', $url, ['Authorization: Bearer ' . $this->livetoken]);
+
+        if (404 === $status) {
+            return null;
+        }
+
+        if (200 !== $status) {
+            throw new SekretoError('sekreto: infisical error: ' . $status);
+        }
+
+        $value = $body['secret']['secretValue'] ?? null;
+
+        return null === $value ? null : (string) $value;
+    }
+
+    public function describe(): string
+    {
+        return 'infisical:' . ($this->opts['project'] ?? '')
+            . '/' . ($this->opts['environment'] ?? '');
+    }
+}
+
+/**
+ * The `infisical` provider kind, as a voxgig/plugin definition. Pass it to
+ * `Sekreto` in the `plugins` option; nothing else loads it.
+ *
+ * @return array<string, mixed>
+ */
+function infisical(): array
+{
+    return providerplugin('infisical', fn(array $spec) => new InfisicalProvider($spec));
+}